From patchwork Mon Oct 12 13:26:34 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 270399 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id F1150C433DF for ; Mon, 12 Oct 2020 13:32:33 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id ADB4920838 for ; Mon, 12 Oct 2020 13:32:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509553; bh=omDmb/EHkfaofnfyWtsh79Yx1RS9yvzCCe9Y5cUMIIs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=wliG6+84/yUoJYErsC6uhu5+sqONaKcny1/qZmVUelB3Hp+jqOxbMklRBRQAx7qdE tHOAKUiEp0EA6QvbXLQFzX2AgKAYJQ/8sx9P6+r1cDes/EyVGKCxPVw2463d692qlf FnpoO8dLUrxgEkkBHp44dAL2L0ThJoVFTx2A3eHM= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388567AbgJLNcb (ORCPT ); Mon, 12 Oct 2020 09:32:31 -0400 Received: from mail.kernel.org ([198.145.29.99]:34080 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730590AbgJLNcR (ORCPT ); Mon, 12 Oct 2020 09:32:17 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id CB9282076E; Mon, 12 Oct 2020 13:32:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509537; bh=omDmb/EHkfaofnfyWtsh79Yx1RS9yvzCCe9Y5cUMIIs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=UZmVkqxrSn56fflqmQqaWy/X+K1fAnjvXCZo/0g4NOmADoowNCVUgbXnASczTL60G yo9a1bdBM4U4czwzYgwhse6huvde9d3YyfB63u1BUEVY9snfSmkseuyV2+5mvsVnUk 4I+b93JB8DlDB9CtSDKC26TBURUNWABbyT60dLrI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lucy Yan , Moritz Fischer , "David S. Miller" , Sasha Levin Subject: [PATCH 4.4 04/39] net: dec: de2104x: Increase receive ring size for Tulip Date: Mon, 12 Oct 2020 15:26:34 +0200 Message-Id: <20201012132628.345860596@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132628.130632267@linuxfoundation.org> References: <20201012132628.130632267@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Lucy Yan [ Upstream commit ee460417d254d941dfea5fb7cff841f589643992 ] Increase Rx ring size to address issue where hardware is reaching the receive work limit. Before: [ 102.223342] de2104x 0000:17:00.0 eth0: rx work limit reached [ 102.245695] de2104x 0000:17:00.0 eth0: rx work limit reached [ 102.251387] de2104x 0000:17:00.0 eth0: rx work limit reached [ 102.267444] de2104x 0000:17:00.0 eth0: rx work limit reached Signed-off-by: Lucy Yan Reviewed-by: Moritz Fischer Signed-off-by: David S. Miller Signed-off-by: Sasha Levin --- drivers/net/ethernet/dec/tulip/de2104x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/dec/tulip/de2104x.c b/drivers/net/ethernet/dec/tulip/de2104x.c index cadcee645f74e..11ce50a057998 100644 --- a/drivers/net/ethernet/dec/tulip/de2104x.c +++ b/drivers/net/ethernet/dec/tulip/de2104x.c @@ -91,7 +91,7 @@ MODULE_PARM_DESC (rx_copybreak, "de2104x Breakpoint at which Rx packets are copi #define DSL CONFIG_DE2104X_DSL #endif -#define DE_RX_RING_SIZE 64 +#define DE_RX_RING_SIZE 128 #define DE_TX_RING_SIZE 64 #define DE_RING_BYTES \ ((sizeof(struct de_desc) * DE_RX_RING_SIZE) + \ From patchwork Mon Oct 12 13:26:35 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 270400 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 10894C43457 for ; Mon, 12 Oct 2020 13:32:26 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id D49BA204EA for ; Mon, 12 Oct 2020 13:32:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509545; bh=krMwwb9kglF5rmiiF6Q1YgXrmnRlIkkhZ1zwowzi0ps=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=UPsHi/4OLM5mKgnJVrB95Ovt48e4Nf99Qef+zJVrTSJ8to1MOzTA6mBCMyj0e7sio c79uqH3K7E9SxJ0+APEWD+kP4ZYo2upA5AklXbS3ce4IIfk+e9ZOzDdX+OYQ2OC4DN tpvAfrNfTNu4nsgVKG+vLOHPFrY6fCxFkIM/YwXM= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730626AbgJLNcW (ORCPT ); Mon, 12 Oct 2020 09:32:22 -0400 Received: from mail.kernel.org ([198.145.29.99]:34140 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730618AbgJLNcV (ORCPT ); Mon, 12 Oct 2020 09:32:21 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 155422078E; Mon, 12 Oct 2020 13:32:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509539; bh=krMwwb9kglF5rmiiF6Q1YgXrmnRlIkkhZ1zwowzi0ps=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=pGkqyV6jV0hvS4zoq/HXJPYHRdt4xar4hWm91Y9EjIcnZsVLd3NvrsmBCKPwXJvMX 9hfCXkrWBlI5PY2muaO+7P3ErSvrkibz3762334ynhmauNkTjJZYyyepElKNEAx8Hj 2wMHWbBUilrli6jjj3Z4sD56gM+QdRjgeXgfVKrQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Olympia Giannou , "David S. Miller" , Sasha Levin Subject: [PATCH 4.4 05/39] rndis_host: increase sleep time in the query-response loop Date: Mon, 12 Oct 2020 15:26:35 +0200 Message-Id: <20201012132628.396131366@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132628.130632267@linuxfoundation.org> References: <20201012132628.130632267@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Olympia Giannou [ Upstream commit 4202c9fdf03d79dedaa94b2c4cf574f25793d669 ] Some WinCE devices face connectivity issues via the NDIS interface. They fail to register, resulting in -110 timeout errors and failures during the probe procedure. In this kind of WinCE devices, the Windows-side ndis driver needs quite more time to be loaded and configured, so that the linux rndis host queries to them fail to be responded correctly on time. More specifically, when INIT is called on the WinCE side - no other requests can be served by the Client and this results in a failed QUERY afterwards. The increase of the waiting time on the side of the linux rndis host in the command-response loop leaves the INIT process to complete and respond to a QUERY, which comes afterwards. The WinCE devices with this special "feature" in their ndis driver are satisfied by this fix. Signed-off-by: Olympia Giannou Signed-off-by: David S. Miller Signed-off-by: Sasha Levin --- drivers/net/usb/rndis_host.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c index 524a47a281207..b20b380d91bf6 100644 --- a/drivers/net/usb/rndis_host.c +++ b/drivers/net/usb/rndis_host.c @@ -213,7 +213,7 @@ int rndis_command(struct usbnet *dev, struct rndis_msg_hdr *buf, int buflen) dev_dbg(&info->control->dev, "rndis response error, code %d\n", retval); } - msleep(20); + msleep(40); } dev_dbg(&info->control->dev, "rndis response timeout\n"); return -ETIMEDOUT; From patchwork Mon Oct 12 13:26:38 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 270390 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 27D92C433DF for ; Mon, 12 Oct 2020 13:33:59 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id D3A94221FF for ; Mon, 12 Oct 2020 13:33:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509638; bh=LGXr3Fb2J82Lc2+22Ud1es4udhjjIXRiFM5vElhzJt4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=RvuuFNyYEbWGla0hFgmwUIAfaxjbt9vcmp0TViebhnN4UvxsWQ9GpuVwAvhCH8Qhi jYXGuwJYk10tMwuBa4/SixqFUbk6abfav1F1PobWnRoiNxWB+udAX+kinHkAPJ9aQy NBCXdv1o8MjQe6p83TU06/J4E+gR7yXWqg8hHPJM= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388370AbgJLNdF (ORCPT ); Mon, 12 Oct 2020 09:33:05 -0400 Received: from mail.kernel.org ([198.145.29.99]:34274 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388530AbgJLNc1 (ORCPT ); Mon, 12 Oct 2020 09:32:27 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 82011204EA; Mon, 12 Oct 2020 13:32:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509547; bh=LGXr3Fb2J82Lc2+22Ud1es4udhjjIXRiFM5vElhzJt4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cq7qKMvRAoq0P9xEI3iJ/GN9bzAZlYZK23q5bC92redngbyQvHJhlhUbrpIsWg9kU c0rMd1ZHUHnsSN/opzvuLsRf66Kw/EgzzLk+801paDNGq2BJ+K9RBC/6NE7NsVgWMi MSjZb6P/Vfs1MYheg6KGKwB6GwX9eHZqjYmLdCns= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jeffrey Mitchell , Trond Myklebust , Sasha Levin Subject: [PATCH 4.4 08/39] nfs: Fix security label length not being reset Date: Mon, 12 Oct 2020 15:26:38 +0200 Message-Id: <20201012132628.543672457@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132628.130632267@linuxfoundation.org> References: <20201012132628.130632267@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Jeffrey Mitchell [ Upstream commit d33030e2ee3508d65db5644551435310df86010e ] nfs_readdir_page_filler() iterates over entries in a directory, reusing the same security label buffer, but does not reset the buffer's length. This causes decode_attr_security_label() to return -ERANGE if an entry's security label is longer than the previous one's. This error, in nfs4_decode_dirent(), only gets passed up as -EAGAIN, which causes another failed attempt to copy into the buffer. The second error is ignored and the remaining entries do not show up in ls, specifically the getdents64() syscall. Reproduce by creating multiple files in NFS and giving one of the later files a longer security label. ls will not see that file nor any that are added afterwards, though they will exist on the backend. In nfs_readdir_page_filler(), reset security label buffer length before every reuse Signed-off-by: Jeffrey Mitchell Fixes: b4487b935452 ("nfs: Fix getxattr kernel panic and memory overflow") Signed-off-by: Trond Myklebust Signed-off-by: Sasha Levin --- fs/nfs/dir.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c index 21e5fcbcb2272..ba7e98d8ce098 100644 --- a/fs/nfs/dir.c +++ b/fs/nfs/dir.c @@ -562,6 +562,9 @@ int nfs_readdir_page_filler(nfs_readdir_descriptor_t *desc, struct nfs_entry *en xdr_set_scratch_buffer(&stream, page_address(scratch), PAGE_SIZE); do { + if (entry->label) + entry->label->len = NFS4_MAXLABELLEN; + status = xdr_decode(desc, entry, &stream); if (status != 0) { if (status == -EAGAIN) From patchwork Mon Oct 12 13:26:39 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 317639 Delivered-To: patch@linaro.org Received: by 2002:a92:d603:0:0:0:0:0 with SMTP id w3csp4627819ilm; Mon, 12 Oct 2020 06:33:07 -0700 (PDT) X-Google-Smtp-Source: ABdhPJxYd7ZfvcnBD3n/IrDiLDVp+7bFbSj4qRoGDeDFP5MZR5ONL77Hueswmn5BF47VP7vBpNpC X-Received: by 2002:a17:906:791:: with SMTP id l17mr27013352ejc.361.1602509587152; Mon, 12 Oct 2020 06:33:07 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1602509587; cv=none; d=google.com; s=arc-20160816; b=zMm4JOafL9m5bU5Fa2pICxR/C8v1Sd7Q3jHoefJ7NS/cTEUp3tEK93iySYtYT6qQ/2 5xCFpCpbMdKPyzjOJo6MZJvMzHdWUkxPRLH7bvExk4M4whFSYv07AM7nw3VH3l6Vh3F/ ELPM4j/27ZEXU9hrDL50KA8nBfSRz228szkZ15YBk8qrmUZdee08c3vQdNYjenzdPQnl YAPmMVzoFO0QHUE+fS17urkD7QhIx0BQTMXcRRVct1ypfJq1NFZedzMFSAQbEzhpiF/7 +olyPDjkeMDaxNowbXhaaf+BfPwGBZY/8GH1BcAm8fLW6GA60UlYRJno/Ekb8CmIu69r sywA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=9TStdt0P1+rr/5pJjeLyv3X0xh2cKVno/Cgk8k8eNiM=; b=k1PglcfQGsBufjF4Aw8EG23uOC6tt/JW23IIVMZ7iOuBd5dT56NKFWtp+uAMYbxZ+L t6Inl4SOY3bHN79EKNPj2IFIH38/1xlHjWxuTQU8r1Lxi1lhYeMdJbQBYpvr5xQR8Pof h/CFQkJIenQhju54DpgCf7jmGJ/dYe6elBjGRa37k2wy91nBKgLxsGuJ/s/E73m3GnG3 EBceg6CmonmT6pH+ai6l/AMCjCMF77wBl2Im1DupmqHBM5ms6C8tKqb78kcrylymZmkN iucsSCJhfKH8LqvyGLAsVkspZD5XufwyQS9w0b42eeHOehBsmzwnyCXaIPkSl8pM4aJD i7Dg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=051hEvlO; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id r17si1089638edo.383.2020.10.12.06.33.06; Mon, 12 Oct 2020 06:33:07 -0700 (PDT) Received-SPF: pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=051hEvlO; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388798AbgJLNdF (ORCPT + 15 others); Mon, 12 Oct 2020 09:33:05 -0400 Received: from mail.kernel.org ([198.145.29.99]:34328 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388543AbgJLNc3 (ORCPT ); Mon, 12 Oct 2020 09:32:29 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id CD2112076E; Mon, 12 Oct 2020 13:32:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509549; bh=C/Ge/qyXNDwS3BWaxLVKeCmxSaHKd3So69PPv/hPRso=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=051hEvlOV9prbDeSEDFM2vZiAYRPPgojnaUYzd2vPQSxpZR9RqgQ15WWgeIiHvG4K lI36D50rvsx27HewCoeL1VW3SttatJ7HjCwvDOQVqKt2NTmVVHVdEO2bKXOrko1EA/ c6misoxLXTbAJu1zPQed+WpFX5c9ABdbjFp9uZYM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Marek Szyprowski , Krzysztof Kozlowski , Sylwester Nawrocki , Stephen Boyd , Sasha Levin Subject: [PATCH 4.4 09/39] clk: samsung: exynos4: mark chipid clock as CLK_IGNORE_UNUSED Date: Mon, 12 Oct 2020 15:26:39 +0200 Message-Id: <20201012132628.593731666@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132628.130632267@linuxfoundation.org> References: <20201012132628.130632267@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Marek Szyprowski [ Upstream commit f3bb0f796f5ffe32f0fbdce5b1b12eb85511158f ] The ChipID IO region has it's own clock, which is being disabled while scanning for unused clocks. It turned out that some CPU hotplug, CPU idle or even SOC firmware code depends on the reads from that area. Fix the mysterious hang caused by entering deep CPU idle state by ignoring the 'chipid' clock during unused clocks scan, as there are no direct clients for it which will keep it enabled. Fixes: e062b571777f ("clk: exynos4: register clocks using common clock framework") Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20200922124046.10496-1-m.szyprowski@samsung.com Reviewed-by: Krzysztof Kozlowski Acked-by: Sylwester Nawrocki Signed-off-by: Stephen Boyd Signed-off-by: Sasha Levin --- drivers/clk/samsung/clk-exynos4.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) -- 2.25.1 diff --git a/drivers/clk/samsung/clk-exynos4.c b/drivers/clk/samsung/clk-exynos4.c index 6c8e45e007c84..8edbb20ccff5e 100644 --- a/drivers/clk/samsung/clk-exynos4.c +++ b/drivers/clk/samsung/clk-exynos4.c @@ -1059,7 +1059,7 @@ static struct samsung_gate_clock exynos4210_gate_clks[] __initdata = { GATE(CLK_PCIE, "pcie", "aclk133", GATE_IP_FSYS, 14, 0, 0), GATE(CLK_SMMU_PCIE, "smmu_pcie", "aclk133", GATE_IP_FSYS, 18, 0, 0), GATE(CLK_MODEMIF, "modemif", "aclk100", GATE_IP_PERIL, 28, 0, 0), - GATE(CLK_CHIPID, "chipid", "aclk100", E4210_GATE_IP_PERIR, 0, 0, 0), + GATE(CLK_CHIPID, "chipid", "aclk100", E4210_GATE_IP_PERIR, 0, CLK_IGNORE_UNUSED, 0), GATE(CLK_SYSREG, "sysreg", "aclk100", E4210_GATE_IP_PERIR, 0, CLK_IGNORE_UNUSED, 0), GATE(CLK_HDMI_CEC, "hdmi_cec", "aclk100", E4210_GATE_IP_PERIR, 11, 0, @@ -1100,7 +1100,7 @@ static struct samsung_gate_clock exynos4x12_gate_clks[] __initdata = { 0), GATE(CLK_TSADC, "tsadc", "aclk133", E4X12_GATE_BUS_FSYS1, 16, 0, 0), GATE(CLK_MIPI_HSI, "mipi_hsi", "aclk133", GATE_IP_FSYS, 10, 0, 0), - GATE(CLK_CHIPID, "chipid", "aclk100", E4X12_GATE_IP_PERIR, 0, 0, 0), + GATE(CLK_CHIPID, "chipid", "aclk100", E4X12_GATE_IP_PERIR, 0, CLK_IGNORE_UNUSED, 0), GATE(CLK_SYSREG, "sysreg", "aclk100", E4X12_GATE_IP_PERIR, 1, CLK_IGNORE_UNUSED, 0), GATE(CLK_HDMI_CEC, "hdmi_cec", "aclk100", E4X12_GATE_IP_PERIR, 11, 0, From patchwork Mon Oct 12 13:26:41 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 270401 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4324CC433E7 for ; Mon, 12 Oct 2020 13:32:09 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id DB0E82087E for ; Mon, 12 Oct 2020 13:32:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509529; bh=CU2iw3b6Eixu2oQ+2Yk4LKv+dyXLOZXsx9c/YQcPLw4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=j1BbNuuVdatr+6ds9qJ8V+/OigJbPw3S8IoSdogKcGVvhSk0rVp5kqnfbPD2Nf1hu 401w1yqR0F3yRNOgyC3MLucotAbq2ZubK1oKSf21BlxOGJFI4dwsgI4BId8BNUb/cr xYZkxdU3eKg53bA9u6JR2ReAXz6TkQbZMr/Tfyk4= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730073AbgJLNcD (ORCPT ); Mon, 12 Oct 2020 09:32:03 -0400 Received: from mail.kernel.org ([198.145.29.99]:33772 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730032AbgJLNcB (ORCPT ); Mon, 12 Oct 2020 09:32:01 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id A6025204EA; Mon, 12 Oct 2020 13:32:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509521; bh=CU2iw3b6Eixu2oQ+2Yk4LKv+dyXLOZXsx9c/YQcPLw4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DB2BpscsGcSf1MxVd+xxcOuEMchGPE+fSaLSkfOHeEZ5o+2edsnXT8G4U0W18DkyG ecnf2Hvm+Z06NF+t1nIk9aaC1+gsUQHn9CpTpH4/0Ntrcimbn9gWNIMxX4WmIab1Lk Ov9u/HweVkP//tMoh9SEJDHXJw5qpVI/NNy4lk1M= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Nicolas VINCENT , Jochen Friedrich , Christophe Leroy , Wolfram Sang , Sasha Levin Subject: [PATCH 4.4 11/39] i2c: cpm: Fix i2c_ram structure Date: Mon, 12 Oct 2020 15:26:41 +0200 Message-Id: <20201012132628.679679830@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132628.130632267@linuxfoundation.org> References: <20201012132628.130632267@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Nicolas VINCENT [ Upstream commit a2bd970aa62f2f7f80fd0d212b1d4ccea5df4aed ] the i2c_ram structure is missing the sdmatmp field mentionned in datasheet for MPC8272 at paragraph 36.5. With this field missing, the hardware would write past the allocated memory done through cpm_muram_alloc for the i2c_ram structure and land in memory allocated for the buffers descriptors corrupting the cbd_bufaddr field. Since this field is only set during setup(), the first i2c transaction would work and the following would send data read from an arbitrary memory location. Fixes: 61045dbe9d8d ("i2c: Add support for I2C bus on Freescale CPM1/CPM2 controllers") Signed-off-by: Nicolas VINCENT Acked-by: Jochen Friedrich Acked-by: Christophe Leroy Signed-off-by: Wolfram Sang Signed-off-by: Sasha Levin --- drivers/i2c/busses/i2c-cpm.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/i2c/busses/i2c-cpm.c b/drivers/i2c/busses/i2c-cpm.c index b167ab25310a3..34a35e927fc6d 100644 --- a/drivers/i2c/busses/i2c-cpm.c +++ b/drivers/i2c/busses/i2c-cpm.c @@ -74,6 +74,9 @@ struct i2c_ram { char res1[4]; /* Reserved */ ushort rpbase; /* Relocation pointer */ char res2[2]; /* Reserved */ + /* The following elements are only for CPM2 */ + char res3[4]; /* Reserved */ + uint sdmatmp; /* Internal */ }; #define I2COM_START 0x80 From patchwork Mon Oct 12 13:26:43 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 270194 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id DFBF1C433E7 for ; Mon, 12 Oct 2020 14:09:10 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id ABCF72076E for ; Mon, 12 Oct 2020 14:09:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602511750; bh=1CBKx9O7jZypuIkj2kjJ55BzDRf7nX1Xj++lpnrlKl4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=ni7zkPlnEWNf2A2YAyi9nm0d1qpFcrvl1DGFhJdQicIoyiNXnyIuOL0sQD8YzFFrn PSo6l1YOEp8qncCaLgsauAuMAgG9yTVQfeKy7WJ6tHLh8PxIC1alZTEX4mQvUjrR2t dM3PvtUDUYmmRZ83FA996CoZ2jnG5Vd1HwAT0UV0= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730390AbgJLNcN (ORCPT ); Mon, 12 Oct 2020 09:32:13 -0400 Received: from mail.kernel.org ([198.145.29.99]:33870 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730032AbgJLNcG (ORCPT ); Mon, 12 Oct 2020 09:32:06 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 36AEA20838; Mon, 12 Oct 2020 13:32:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509525; bh=1CBKx9O7jZypuIkj2kjJ55BzDRf7nX1Xj++lpnrlKl4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=SfjKb8Lz6X6LW05CZdE3saj/i6u6MpvkDEbCmrPxYBWNFHbMAx//qPv2qnWnLnDga p+JGZR57X7OSxuEtU+tY0AZ2fqRgLgCEeBrtfxi0v/i2Hokkp0SZtQbJpORiowBxag c4DOpm8B9fsCKjWvufKAoYa2MbEaDr9KHxvSPjJo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Al Viro Subject: [PATCH 4.4 13/39] epoll: replace ->visited/visited_list with generation count Date: Mon, 12 Oct 2020 15:26:43 +0200 Message-Id: <20201012132628.777186931@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132628.130632267@linuxfoundation.org> References: <20201012132628.130632267@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Al Viro commit 18306c404abe18a0972587a6266830583c60c928 upstream. removes the need to clear it, along with the races. Signed-off-by: Al Viro Signed-off-by: Greg Kroah-Hartman --- fs/eventpoll.c | 26 +++++++------------------- 1 file changed, 7 insertions(+), 19 deletions(-) --- a/fs/eventpoll.c +++ b/fs/eventpoll.c @@ -217,8 +217,7 @@ struct eventpoll { struct file *file; /* used to optimize loop detection check */ - int visited; - struct list_head visited_list_link; + u64 gen; }; /* Wait structure used by the poll hooks */ @@ -262,6 +261,8 @@ static long max_user_watches __read_most */ static DEFINE_MUTEX(epmutex); +static u64 loop_check_gen = 0; + /* Used to check for epoll file descriptor inclusion loops */ static struct nested_calls poll_loop_ncalls; @@ -277,9 +278,6 @@ static struct kmem_cache *epi_cache __re /* Slab cache used to allocate "struct eppoll_entry" */ static struct kmem_cache *pwq_cache __read_mostly; -/* Visited nodes during ep_loop_check(), so we can unset them when we finish */ -static LIST_HEAD(visited_list); - /* * List of files with newly added links, where we may need to limit the number * of emanating paths. Protected by the epmutex. @@ -1696,13 +1694,12 @@ static int ep_loop_check_proc(void *priv struct epitem *epi; mutex_lock_nested(&ep->mtx, call_nests + 1); - ep->visited = 1; - list_add(&ep->visited_list_link, &visited_list); + ep->gen = loop_check_gen; for (rbp = rb_first(&ep->rbr); rbp; rbp = rb_next(rbp)) { epi = rb_entry(rbp, struct epitem, rbn); if (unlikely(is_file_epoll(epi->ffd.file))) { ep_tovisit = epi->ffd.file->private_data; - if (ep_tovisit->visited) + if (ep_tovisit->gen == loop_check_gen) continue; error = ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS, ep_loop_check_proc, epi->ffd.file, @@ -1743,18 +1740,8 @@ static int ep_loop_check_proc(void *priv */ static int ep_loop_check(struct eventpoll *ep, struct file *file) { - int ret; - struct eventpoll *ep_cur, *ep_next; - - ret = ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS, + return ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS, ep_loop_check_proc, file, ep, current); - /* clear visited list */ - list_for_each_entry_safe(ep_cur, ep_next, &visited_list, - visited_list_link) { - ep_cur->visited = 0; - list_del(&ep_cur->visited_list_link); - } - return ret; } static void clear_tfile_check_list(void) @@ -1956,6 +1943,7 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, in error_tgt_fput: if (full_check) { clear_tfile_check_list(); + loop_check_gen++; mutex_unlock(&epmutex); } From patchwork Mon Oct 12 13:26:44 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 270398 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 572A7C433DF for ; Mon, 12 Oct 2020 13:32:42 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 13BB3208B8 for ; Mon, 12 Oct 2020 13:32:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509562; bh=tG7NBlJqpiCfPJruqzP8/L8q8AcSqtF400RxEoSh3yw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=gxksek798ICLRKT6qGGgFs4vDPivBlOG3d1IQrziYtXHrk20o1vevSa2VjhdSwel+ japL4/56A/Zl0C5dCDTK2IMCWpr/cKcXKC6bcJrCMJt4TJQVhyUESYsCZoP6vNeTzF V4bVJfgahSJXzo1GHRHM9Qx9gItXYAitulZvsNvA= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730431AbgJLNcO (ORCPT ); Mon, 12 Oct 2020 09:32:14 -0400 Received: from mail.kernel.org ([198.145.29.99]:33934 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730150AbgJLNcI (ORCPT ); Mon, 12 Oct 2020 09:32:08 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 969762078E; Mon, 12 Oct 2020 13:32:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509528; bh=tG7NBlJqpiCfPJruqzP8/L8q8AcSqtF400RxEoSh3yw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XToGHP16VGIN+WSZDQic6TaPWWK6WAEbdJiqZ6zrkdojy0CxGy50HuQzsuWo6fnFG S7gdHnUuzDfRX7KHm+I0s8ETKA5yo5UhQyfaQyD8QBTO6ymsP4ievLy6IM+a2UGz1h 2nAKp9LpYojY5/nuIZsnDKI/OMKw7Ufgp+AZDg08= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Al Viro Subject: [PATCH 4.4 14/39] epoll: EPOLL_CTL_ADD: close the race in decision to take fast path Date: Mon, 12 Oct 2020 15:26:44 +0200 Message-Id: <20201012132628.816631680@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132628.130632267@linuxfoundation.org> References: <20201012132628.130632267@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Al Viro commit fe0a916c1eae8e17e86c3753d13919177d63ed7e upstream. Checking for the lack of epitems refering to the epoll we want to insert into is not enough; we might have an insertion of that epoll into another one that has already collected the set of files to recheck for excessive reverse paths, but hasn't gotten to creating/inserting the epitem for it. However, any such insertion in progress can be detected - it will update the generation count in our epoll when it's done looking through it for files to check. That gets done under ->mtx of our epoll and that allows us to detect that safely. We are *not* holding epmutex here, so the generation count is not stable. However, since both the update of ep->gen by loop check and (later) insertion into ->f_ep_link are done with ep->mtx held, we are fine - the sequence is grab epmutex bump loop_check_gen ... grab tep->mtx // 1 tep->gen = loop_check_gen ... drop tep->mtx // 2 ... grab tep->mtx // 3 ... insert into ->f_ep_link ... drop tep->mtx // 4 bump loop_check_gen drop epmutex and if the fastpath check in another thread happens for that eventpoll, it can come * before (1) - in that case fastpath is just fine * after (4) - we'll see non-empty ->f_ep_link, slow path taken * between (2) and (3) - loop_check_gen is stable, with ->mtx providing barriers and we end up taking slow path. Note that ->f_ep_link emptiness check is slightly racy - we are protected against insertions into that list, but removals can happen right under us. Not a problem - in the worst case we'll end up taking a slow path for no good reason. Signed-off-by: Al Viro Signed-off-by: Greg Kroah-Hartman --- fs/eventpoll.c | 1 + 1 file changed, 1 insertion(+) --- a/fs/eventpoll.c +++ b/fs/eventpoll.c @@ -1885,6 +1885,7 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, in mutex_lock_nested(&ep->mtx, 0); if (op == EPOLL_CTL_ADD) { if (!list_empty(&f.file->f_ep_links) || + ep->gen == loop_check_gen || is_file_epoll(tf.file)) { full_check = 1; mutex_unlock(&ep->mtx); From patchwork Mon Oct 12 13:26:47 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 270395 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D4411C433E7 for ; Mon, 12 Oct 2020 13:33:05 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 8BE6C21BE5 for ; Mon, 12 Oct 2020 13:33:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509585; bh=OzOTN8jKo7kNhY9MZajRoUo7sdMGGo9dIRe98N8tscs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=O/ciNsDNhv9B0jyABGbZ0oKrkcdBYa2MRXayr9YPnOfV/VD4nEncAArSNwy97124n BjcOMmJN0N3zNmIkb7G5rGZycvjwwnXSnR61BgtTVtLwBu+3DE9cJocuCuwVAg7PBm P6A5twlrLQ4V3WE+mi7of8rq7CQxmKtDuMLXhxkk= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388614AbgJLNdE (ORCPT ); Mon, 12 Oct 2020 09:33:04 -0400 Received: from mail.kernel.org ([198.145.29.99]:34508 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388663AbgJLNce (ORCPT ); Mon, 12 Oct 2020 09:32:34 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 674502078E; Mon, 12 Oct 2020 13:32:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509553; bh=OzOTN8jKo7kNhY9MZajRoUo7sdMGGo9dIRe98N8tscs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=X0mof9CgiClCvUhHVIuAXDHNUU3oOn1FbB1GBknNwhMFcXXFtvaQzw7M7i90CoEwT huGVzEjIB+oi9d005Z151rEuSaH97iTdNJWfvjs8nmz8aP4EP9rzICm89LywDVYNIB MHRZzb/T3rWcxIu3GT1P4HLl4q2g2Cgh45tcuwyA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Peilin Ye , Daniel Vetter Subject: [PATCH 4.4 17/39] fbdev, newport_con: Move FONT_EXTRA_WORDS macros into linux/font.h Date: Mon, 12 Oct 2020 15:26:47 +0200 Message-Id: <20201012132628.945606515@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132628.130632267@linuxfoundation.org> References: <20201012132628.130632267@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Peilin Ye commit bb0890b4cd7f8203e3aa99c6d0f062d6acdaad27 upstream. drivers/video/console/newport_con.c is borrowing FONT_EXTRA_WORDS macros from drivers/video/fbdev/core/fbcon.h. To keep things simple, move all definitions into . Since newport_con now uses four extra words, initialize the fourth word in newport_set_font() properly. Cc: stable@vger.kernel.org Signed-off-by: Peilin Ye Reviewed-by: Greg Kroah-Hartman Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/7fb8bc9b0abc676ada6b7ac0e0bd443499357267.1600953813.git.yepeilin.cs@gmail.com Signed-off-by: Greg Kroah-Hartman --- drivers/video/console/fbcon.h | 7 ------- drivers/video/console/fbcon_rotate.c | 1 + drivers/video/console/newport_con.c | 7 +------ drivers/video/console/tileblit.c | 1 + include/linux/font.h | 8 ++++++++ 5 files changed, 11 insertions(+), 13 deletions(-) --- a/drivers/video/console/fbcon.h +++ b/drivers/video/console/fbcon.h @@ -151,13 +151,6 @@ static inline int attr_col_ec(int shift, #define attr_bgcol_ec(bgshift, vc, info) attr_col_ec(bgshift, vc, info, 0) #define attr_fgcol_ec(fgshift, vc, info) attr_col_ec(fgshift, vc, info, 1) -/* Font */ -#define REFCOUNT(fd) (((int *)(fd))[-1]) -#define FNTSIZE(fd) (((int *)(fd))[-2]) -#define FNTCHARCNT(fd) (((int *)(fd))[-3]) -#define FNTSUM(fd) (((int *)(fd))[-4]) -#define FONT_EXTRA_WORDS 4 - /* * Scroll Method */ --- a/drivers/video/console/fbcon_rotate.c +++ b/drivers/video/console/fbcon_rotate.c @@ -14,6 +14,7 @@ #include #include #include +#include #include #include "fbcon.h" #include "fbcon_rotate.h" --- a/drivers/video/console/newport_con.c +++ b/drivers/video/console/newport_con.c @@ -35,12 +35,6 @@ #define FONT_DATA ((unsigned char *)font_vga_8x16.data) -/* borrowed from fbcon.c */ -#define REFCOUNT(fd) (((int *)(fd))[-1]) -#define FNTSIZE(fd) (((int *)(fd))[-2]) -#define FNTCHARCNT(fd) (((int *)(fd))[-3]) -#define FONT_EXTRA_WORDS 3 - static unsigned char *font_data[MAX_NR_CONSOLES]; static struct newport_regs *npregs; @@ -522,6 +516,7 @@ static int newport_set_font(int unit, st FNTSIZE(new_data) = size; FNTCHARCNT(new_data) = op->charcount; REFCOUNT(new_data) = 0; /* usage counter */ + FNTSUM(new_data) = 0; p = new_data; for (i = 0; i < op->charcount; i++) { --- a/drivers/video/console/tileblit.c +++ b/drivers/video/console/tileblit.c @@ -13,6 +13,7 @@ #include #include #include +#include #include #include "fbcon.h" --- a/include/linux/font.h +++ b/include/linux/font.h @@ -57,4 +57,12 @@ extern const struct font_desc *get_defau /* Max. length for the name of a predefined font */ #define MAX_FONT_NAME 32 +/* Extra word getters */ +#define REFCOUNT(fd) (((int *)(fd))[-1]) +#define FNTSIZE(fd) (((int *)(fd))[-2]) +#define FNTCHARCNT(fd) (((int *)(fd))[-3]) +#define FNTSUM(fd) (((int *)(fd))[-4]) + +#define FONT_EXTRA_WORDS 4 + #endif /* _VIDEO_FONT_H */ From patchwork Mon Oct 12 13:26:48 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 270391 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id EDD53C43457 for ; Mon, 12 Oct 2020 13:33:53 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id B2CF1221FF for ; Mon, 12 Oct 2020 13:33:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509633; bh=3hi9m9Cnj4WTgtPvSnSz+apK7xXQCPwDRaPgs7QdrGM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=pT6i5gkgPihjnpQQbKN/WNOuTII+rZlUteZwSUhrJE59ghdjWC1OSIHHSBSOiJUgF Aq99iBgCXm3Vf8/weaMMbX508yfktm2hJ6piAOptPzi2LvoywecJRLev8LPjWiJCgG L+/2nmbNBCBStYaihKrlqwqYL1tXowrOxDeOmNXs= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2389092AbgJLNdI (ORCPT ); Mon, 12 Oct 2020 09:33:08 -0400 Received: from mail.kernel.org ([198.145.29.99]:35184 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2389089AbgJLNdH (ORCPT ); Mon, 12 Oct 2020 09:33:07 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 1E45920BED; Mon, 12 Oct 2020 13:32:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509579; bh=3hi9m9Cnj4WTgtPvSnSz+apK7xXQCPwDRaPgs7QdrGM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ksb5J48SpIu5QDWqNAkke1brqFrmLN8f6gSbMlctuPAP73fqYe6s+FJoba3rpZS7c Sk2JTAH7hzKrDaT8xYE1eamn5sQgP9ws6mKtu7waRUippdrC1/GllH3VeU4+GvX5i3 jGRpPCnKe+1ubxqamX6vl4t1MQCzfn4Kamiswapo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Peilin Ye , Daniel Vetter Subject: [PATCH 4.4 18/39] Fonts: Support FONT_EXTRA_WORDS macros for built-in fonts Date: Mon, 12 Oct 2020 15:26:48 +0200 Message-Id: <20201012132628.991511271@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132628.130632267@linuxfoundation.org> References: <20201012132628.130632267@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Peilin Ye commit 6735b4632def0640dbdf4eb9f99816aca18c4f16 upstream. syzbot has reported an issue in the framebuffer layer, where a malicious user may overflow our built-in font data buffers. In order to perform a reliable range check, subsystems need to know `FONTDATAMAX` for each built-in font. Unfortunately, our font descriptor, `struct console_font` does not contain `FONTDATAMAX`, and is part of the UAPI, making it infeasible to modify it. For user-provided fonts, the framebuffer layer resolves this issue by reserving four extra words at the beginning of data buffers. Later, whenever a function needs to access them, it simply uses the following macros: Recently we have gathered all the above macros to . Let us do the same thing for built-in fonts, prepend four extra words (including `FONTDATAMAX`) to their data buffers, so that subsystems can use these macros for all fonts, no matter built-in or user-provided. This patch depends on patch "fbdev, newport_con: Move FONT_EXTRA_WORDS macros into linux/font.h". Cc: stable@vger.kernel.org Link: https://syzkaller.appspot.com/bug?id=08b8be45afea11888776f897895aef9ad1c3ecfd Signed-off-by: Peilin Ye Reviewed-by: Greg Kroah-Hartman Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/ef18af00c35fb3cc826048a5f70924ed6ddce95b.1600953813.git.yepeilin.cs@gmail.com Signed-off-by: Greg Kroah-Hartman --- include/linux/font.h | 5 +++++ lib/fonts/font_10x18.c | 9 ++++----- lib/fonts/font_6x10.c | 9 +++++---- lib/fonts/font_6x11.c | 9 ++++----- lib/fonts/font_7x14.c | 9 ++++----- lib/fonts/font_8x16.c | 9 ++++----- lib/fonts/font_8x8.c | 9 ++++----- lib/fonts/font_acorn_8x8.c | 9 ++++++--- lib/fonts/font_mini_4x6.c | 8 ++++---- lib/fonts/font_pearl_8x8.c | 9 ++++----- lib/fonts/font_sun12x22.c | 9 ++++----- lib/fonts/font_sun8x16.c | 7 ++++--- 12 files changed, 52 insertions(+), 49 deletions(-) --- a/include/linux/font.h +++ b/include/linux/font.h @@ -65,4 +65,9 @@ extern const struct font_desc *get_defau #define FONT_EXTRA_WORDS 4 +struct font_data { + unsigned int extra[FONT_EXTRA_WORDS]; + const unsigned char data[]; +} __packed; + #endif /* _VIDEO_FONT_H */ --- a/lib/fonts/font_10x18.c +++ b/lib/fonts/font_10x18.c @@ -7,8 +7,8 @@ #define FONTDATAMAX 9216 -static const unsigned char fontdata_10x18[FONTDATAMAX] = { - +static struct font_data fontdata_10x18 = { + { 0, 0, FONTDATAMAX, 0 }, { /* 0 0x00 '^@' */ 0x00, 0x00, /* 0000000000 */ 0x00, 0x00, /* 0000000000 */ @@ -5128,8 +5128,7 @@ static const unsigned char fontdata_10x1 0x00, 0x00, /* 0000000000 */ 0x00, 0x00, /* 0000000000 */ 0x00, 0x00, /* 0000000000 */ - -}; +} }; const struct font_desc font_10x18 = { @@ -5137,7 +5136,7 @@ const struct font_desc font_10x18 = { .name = "10x18", .width = 10, .height = 18, - .data = fontdata_10x18, + .data = fontdata_10x18.data, #ifdef __sparc__ .pref = 5, #else --- a/lib/fonts/font_6x10.c +++ b/lib/fonts/font_6x10.c @@ -1,7 +1,9 @@ #include -static const unsigned char fontdata_6x10[] = { +#define FONTDATAMAX 2560 +static struct font_data fontdata_6x10 = { + { 0, 0, FONTDATAMAX, 0 }, { /* 0 0x00 '^@' */ 0x00, /* 00000000 */ 0x00, /* 00000000 */ @@ -3073,14 +3075,13 @@ static const unsigned char fontdata_6x10 0x00, /* 00000000 */ 0x00, /* 00000000 */ 0x00, /* 00000000 */ - -}; +} }; const struct font_desc font_6x10 = { .idx = FONT6x10_IDX, .name = "6x10", .width = 6, .height = 10, - .data = fontdata_6x10, + .data = fontdata_6x10.data, .pref = 0, }; --- a/lib/fonts/font_6x11.c +++ b/lib/fonts/font_6x11.c @@ -8,8 +8,8 @@ #define FONTDATAMAX (11*256) -static const unsigned char fontdata_6x11[FONTDATAMAX] = { - +static struct font_data fontdata_6x11 = { + { 0, 0, FONTDATAMAX, 0 }, { /* 0 0x00 '^@' */ 0x00, /* 00000000 */ 0x00, /* 00000000 */ @@ -3337,8 +3337,7 @@ static const unsigned char fontdata_6x11 0x00, /* 00000000 */ 0x00, /* 00000000 */ 0x00, /* 00000000 */ - -}; +} }; const struct font_desc font_vga_6x11 = { @@ -3346,7 +3345,7 @@ const struct font_desc font_vga_6x11 = { .name = "ProFont6x11", .width = 6, .height = 11, - .data = fontdata_6x11, + .data = fontdata_6x11.data, /* Try avoiding this font if possible unless on MAC */ .pref = -2000, }; --- a/lib/fonts/font_7x14.c +++ b/lib/fonts/font_7x14.c @@ -7,8 +7,8 @@ #define FONTDATAMAX 3584 -static const unsigned char fontdata_7x14[FONTDATAMAX] = { - +static struct font_data fontdata_7x14 = { + { 0, 0, FONTDATAMAX, 0 }, { /* 0 0x00 '^@' */ 0x00, /* 0000000 */ 0x00, /* 0000000 */ @@ -4104,8 +4104,7 @@ static const unsigned char fontdata_7x14 0x00, /* 0000000 */ 0x00, /* 0000000 */ 0x00, /* 0000000 */ - -}; +} }; const struct font_desc font_7x14 = { @@ -4113,6 +4112,6 @@ const struct font_desc font_7x14 = { .name = "7x14", .width = 7, .height = 14, - .data = fontdata_7x14, + .data = fontdata_7x14.data, .pref = 0, }; --- a/lib/fonts/font_8x16.c +++ b/lib/fonts/font_8x16.c @@ -9,8 +9,8 @@ #define FONTDATAMAX 4096 -static const unsigned char fontdata_8x16[FONTDATAMAX] = { - +static struct font_data fontdata_8x16 = { + { 0, 0, FONTDATAMAX, 0 }, { /* 0 0x00 '^@' */ 0x00, /* 00000000 */ 0x00, /* 00000000 */ @@ -4618,8 +4618,7 @@ static const unsigned char fontdata_8x16 0x00, /* 00000000 */ 0x00, /* 00000000 */ 0x00, /* 00000000 */ - -}; +} }; const struct font_desc font_vga_8x16 = { @@ -4627,7 +4626,7 @@ const struct font_desc font_vga_8x16 = { .name = "VGA8x16", .width = 8, .height = 16, - .data = fontdata_8x16, + .data = fontdata_8x16.data, .pref = 0, }; EXPORT_SYMBOL(font_vga_8x16); --- a/lib/fonts/font_8x8.c +++ b/lib/fonts/font_8x8.c @@ -8,8 +8,8 @@ #define FONTDATAMAX 2048 -static const unsigned char fontdata_8x8[FONTDATAMAX] = { - +static struct font_data fontdata_8x8 = { + { 0, 0, FONTDATAMAX, 0 }, { /* 0 0x00 '^@' */ 0x00, /* 00000000 */ 0x00, /* 00000000 */ @@ -2569,8 +2569,7 @@ static const unsigned char fontdata_8x8[ 0x00, /* 00000000 */ 0x00, /* 00000000 */ 0x00, /* 00000000 */ - -}; +} }; const struct font_desc font_vga_8x8 = { @@ -2578,6 +2577,6 @@ const struct font_desc font_vga_8x8 = { .name = "VGA8x8", .width = 8, .height = 8, - .data = fontdata_8x8, + .data = fontdata_8x8.data, .pref = 0, }; --- a/lib/fonts/font_acorn_8x8.c +++ b/lib/fonts/font_acorn_8x8.c @@ -2,7 +2,10 @@ #include -static const unsigned char acorndata_8x8[] = { +#define FONTDATAMAX 2048 + +static struct font_data acorndata_8x8 = { +{ 0, 0, FONTDATAMAX, 0 }, { /* 00 */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* ^@ */ /* 01 */ 0x7e, 0x81, 0xa5, 0x81, 0xbd, 0x99, 0x81, 0x7e, /* ^A */ /* 02 */ 0x7e, 0xff, 0xbd, 0xff, 0xc3, 0xe7, 0xff, 0x7e, /* ^B */ @@ -259,14 +262,14 @@ static const unsigned char acorndata_8x8 /* FD */ 0x38, 0x04, 0x18, 0x20, 0x3c, 0x00, 0x00, 0x00, /* FE */ 0x00, 0x00, 0x3c, 0x3c, 0x3c, 0x3c, 0x00, 0x00, /* FF */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 -}; +} }; const struct font_desc font_acorn_8x8 = { .idx = ACORN8x8_IDX, .name = "Acorn8x8", .width = 8, .height = 8, - .data = acorndata_8x8, + .data = acorndata_8x8.data, #ifdef CONFIG_ARCH_ACORN .pref = 20, #else --- a/lib/fonts/font_mini_4x6.c +++ b/lib/fonts/font_mini_4x6.c @@ -43,8 +43,8 @@ __END__; #define FONTDATAMAX 1536 -static const unsigned char fontdata_mini_4x6[FONTDATAMAX] = { - +static struct font_data fontdata_mini_4x6 = { + { 0, 0, FONTDATAMAX, 0 }, { /*{*/ /* Char 0: ' ' */ 0xee, /*= [*** ] */ @@ -2145,14 +2145,14 @@ static const unsigned char fontdata_mini 0xee, /*= [*** ] */ 0x00, /*= [ ] */ /*}*/ -}; +} }; const struct font_desc font_mini_4x6 = { .idx = MINI4x6_IDX, .name = "MINI4x6", .width = 4, .height = 6, - .data = fontdata_mini_4x6, + .data = fontdata_mini_4x6.data, .pref = 3, }; --- a/lib/fonts/font_pearl_8x8.c +++ b/lib/fonts/font_pearl_8x8.c @@ -13,8 +13,8 @@ #define FONTDATAMAX 2048 -static const unsigned char fontdata_pearl8x8[FONTDATAMAX] = { - +static struct font_data fontdata_pearl8x8 = { + { 0, 0, FONTDATAMAX, 0 }, { /* 0 0x00 '^@' */ 0x00, /* 00000000 */ 0x00, /* 00000000 */ @@ -2574,14 +2574,13 @@ static const unsigned char fontdata_pear 0x00, /* 00000000 */ 0x00, /* 00000000 */ 0x00, /* 00000000 */ - -}; +} }; const struct font_desc font_pearl_8x8 = { .idx = PEARL8x8_IDX, .name = "PEARL8x8", .width = 8, .height = 8, - .data = fontdata_pearl8x8, + .data = fontdata_pearl8x8.data, .pref = 2, }; --- a/lib/fonts/font_sun12x22.c +++ b/lib/fonts/font_sun12x22.c @@ -2,8 +2,8 @@ #define FONTDATAMAX 11264 -static const unsigned char fontdata_sun12x22[FONTDATAMAX] = { - +static struct font_data fontdata_sun12x22 = { + { 0, 0, FONTDATAMAX, 0 }, { /* 0 0x00 '^@' */ 0x00, 0x00, /* 000000000000 */ 0x00, 0x00, /* 000000000000 */ @@ -6147,8 +6147,7 @@ static const unsigned char fontdata_sun1 0x00, 0x00, /* 000000000000 */ 0x00, 0x00, /* 000000000000 */ 0x00, 0x00, /* 000000000000 */ - -}; +} }; const struct font_desc font_sun_12x22 = { @@ -6156,7 +6155,7 @@ const struct font_desc font_sun_12x22 = .name = "SUN12x22", .width = 12, .height = 22, - .data = fontdata_sun12x22, + .data = fontdata_sun12x22.data, #ifdef __sparc__ .pref = 5, #else --- a/lib/fonts/font_sun8x16.c +++ b/lib/fonts/font_sun8x16.c @@ -2,7 +2,8 @@ #define FONTDATAMAX 4096 -static const unsigned char fontdata_sun8x16[FONTDATAMAX] = { +static struct font_data fontdata_sun8x16 = { +{ 0, 0, FONTDATAMAX, 0 }, { /* */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /* */ 0x00,0x00,0x7e,0x81,0xa5,0x81,0x81,0xbd,0x99,0x81,0x81,0x7e,0x00,0x00,0x00,0x00, /* */ 0x00,0x00,0x7e,0xff,0xdb,0xff,0xff,0xc3,0xe7,0xff,0xff,0x7e,0x00,0x00,0x00,0x00, @@ -259,14 +260,14 @@ static const unsigned char fontdata_sun8 /* */ 0x00,0x70,0xd8,0x30,0x60,0xc8,0xf8,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /* */ 0x00,0x00,0x00,0x00,0x7c,0x7c,0x7c,0x7c,0x7c,0x7c,0x7c,0x00,0x00,0x00,0x00,0x00, /* */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, -}; +} }; const struct font_desc font_sun_8x16 = { .idx = SUN8x16_IDX, .name = "SUN8x16", .width = 8, .height = 16, - .data = fontdata_sun8x16, + .data = fontdata_sun8x16.data, #ifdef __sparc__ .pref = 10, #else From patchwork Mon Oct 12 13:26:51 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 270393 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C0A25C43457 for ; Mon, 12 Oct 2020 13:33:43 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 77E8922227 for ; Mon, 12 Oct 2020 13:33:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509623; bh=gPuBx3gPVUc99RyVsUHLb0lzfB0NBGik/4Cpbswcs3g=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=qbRkz+DlRShYGUKuVbhpnsUVazV2uOOooeA8rd1qhba2858cp5WxB4Deb5FFSwYR+ prkb5AaKmTJHC4WLkRq9Ncqxn/7zM9gpe28dyCksCiCUSNk7SGwuzZfc0k4ZN3O8Ea 43VCVTnukxPNyk8gWZJziahCB36ISx5d8TSyCvyE= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730595AbgJLNda (ORCPT ); Mon, 12 Oct 2020 09:33:30 -0400 Received: from mail.kernel.org ([198.145.29.99]:35362 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2389130AbgJLNdQ (ORCPT ); Mon, 12 Oct 2020 09:33:16 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 91ED8204EA; Mon, 12 Oct 2020 13:33:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509596; bh=gPuBx3gPVUc99RyVsUHLb0lzfB0NBGik/4Cpbswcs3g=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=I6krY1aKRYxHZccCqNQzbuxbs+3ZfE7euKBs/3uuGfHvq/JsC7TtERBLBGQ4XvFMe /CbK0tgtJolkVvSEdQlRi1zdYDI4oJTm5bgagVgWFLMGF1riCMTrAVZjBTcIg4pAaf dqqni4ozTbhCOVFzYU3bUr+uBQ2hxvJuHIeXV4oI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+b1bb342d1d097516cbda@syzkaller.appspotmail.com, Anant Thazhemadam , Johannes Berg Subject: [PATCH 4.4 21/39] net: wireless: nl80211: fix out-of-bounds access in nl80211_del_key() Date: Mon, 12 Oct 2020 15:26:51 +0200 Message-Id: <20201012132629.133765521@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132628.130632267@linuxfoundation.org> References: <20201012132628.130632267@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Anant Thazhemadam commit 3dc289f8f139997f4e9d3cfccf8738f20d23e47b upstream. In nl80211_parse_key(), key.idx is first initialized as -1. If this value of key.idx remains unmodified and gets returned, and nl80211_key_allowed() also returns 0, then rdev_del_key() gets called with key.idx = -1. This causes an out-of-bounds array access. Handle this issue by checking if the value of key.idx after nl80211_parse_key() is called and return -EINVAL if key.idx < 0. Cc: stable@vger.kernel.org Reported-by: syzbot+b1bb342d1d097516cbda@syzkaller.appspotmail.com Tested-by: syzbot+b1bb342d1d097516cbda@syzkaller.appspotmail.com Signed-off-by: Anant Thazhemadam Link: https://lore.kernel.org/r/20201007035401.9522-1-anant.thazhemadam@gmail.com Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman --- net/wireless/nl80211.c | 3 +++ 1 file changed, 3 insertions(+) --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -3101,6 +3101,9 @@ static int nl80211_del_key(struct sk_buf if (err) return err; + if (key.idx < 0) + return -EINVAL; + if (info->attrs[NL80211_ATTR_MAC]) mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); From patchwork Mon Oct 12 13:26:52 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 270394 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 008C6C433E7 for ; Mon, 12 Oct 2020 13:33:27 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id ACF292074F for ; Mon, 12 Oct 2020 13:33:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509606; bh=kMn9LsPkYIaEn3BCjd0s9jSqH6l7DgqHta1lfxvkPYM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=suNN65TN96fODl+gjrITsu07q5Om1UYTIjM0AraZtmePMTk43jd4Vs85NNGvDFBy4 JU8aF0luKl+m+dJGPLp9hEEtSykCoFBunQ0Qna8LJRa5vO/Eywz28ouwrcL8vI+hVv vwQ36iOokYYScNxNixBErEpLX0XKOVkujH8v8doI= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730193AbgJLNdY (ORCPT ); Mon, 12 Oct 2020 09:33:24 -0400 Received: from mail.kernel.org ([198.145.29.99]:35416 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2389142AbgJLNdS (ORCPT ); Mon, 12 Oct 2020 09:33:18 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id DCCBE2076E; Mon, 12 Oct 2020 13:33:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509598; bh=kMn9LsPkYIaEn3BCjd0s9jSqH6l7DgqHta1lfxvkPYM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Q/seLyquKvvk7mk5OhyGRR7qS7quIfLrtbbpWcoO10R6rxFBmEM/ETJ0Xg8PeSjvZ DzSN8ImdKDUkq5Ss8cVCTdc437IBE0zkhuZAHA8Tb5BCfC4gXMODCwV1GOedvUK64m YUsJu8IjMZOEJKw4DyktoODUeysGMyU7FPTdD7hg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Vegard Nossum , Al Viro , "Eric W. Biederman" , Linus Torvalds Subject: [PATCH 4.4 22/39] usermodehelper: reset umask to default before executing user process Date: Mon, 12 Oct 2020 15:26:52 +0200 Message-Id: <20201012132629.188589120@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132628.130632267@linuxfoundation.org> References: <20201012132628.130632267@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Linus Torvalds commit 4013c1496c49615d90d36b9d513eee8e369778e9 upstream. Kernel threads intentionally do CLONE_FS in order to follow any changes that 'init' does to set up the root directory (or cwd). It is admittedly a bit odd, but it avoids the situation where 'init' does some extensive setup to initialize the system environment, and then we execute a usermode helper program, and it uses the original FS setup from boot time that may be very limited and incomplete. [ Both Al Viro and Eric Biederman point out that 'pivot_root()' will follow the root regardless, since it fixes up other users of root (see chroot_fs_refs() for details), but overmounting root and doing a chroot() would not. ] However, Vegard Nossum noticed that the CLONE_FS not only means that we follow the root and current working directories, it also means we share umask with whatever init changed it to. That wasn't intentional. Just reset umask to the original default (0022) before actually starting the usermode helper program. Reported-by: Vegard Nossum Cc: Al Viro Acked-by: Eric W. Biederman Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- kernel/kmod.c | 9 +++++++++ 1 file changed, 9 insertions(+) --- a/kernel/kmod.c +++ b/kernel/kmod.c @@ -28,6 +28,7 @@ #include #include #include +#include #include #include #include @@ -223,6 +224,14 @@ static int call_usermodehelper_exec_asyn spin_unlock_irq(¤t->sighand->siglock); /* + * Initial kernel threads share ther FS with init, in order to + * get the init root directory. But we've now created a new + * thread that is going to execve a user process and has its own + * 'struct fs_struct'. Reset umask to the default. + */ + current->fs->umask = 0022; + + /* * Our parent (unbound workqueue) runs with elevated scheduling * priority. Avoid propagating that into the userspace child. */ From patchwork Mon Oct 12 13:26:53 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 270195 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0CF5AC43457 for ; Mon, 12 Oct 2020 14:09:00 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id D01F020838 for ; Mon, 12 Oct 2020 14:08:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602511739; bh=iRvc1h8Jd7frY6IyZasTKD964KP/bVwB2tsTNK254ho=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=K6lPBFnMARCMpzL1fbnZhuG45Wlryk8HonRtF8fKZEj35NVD5/csU7igpeOBY4GbN pUUk4fUhGydLpkZwJOJzxoeIA0SXdLamEiZUPhqGsfWJughjNlJdjsskOA032sxlGc AKsutKUGKVILbqX0yNPgmJSi2NgPYatv03vEEgTg= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726897AbgJLOI7 (ORCPT ); Mon, 12 Oct 2020 10:08:59 -0400 Received: from mail.kernel.org ([198.145.29.99]:35472 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2389153AbgJLNdV (ORCPT ); Mon, 12 Oct 2020 09:33:21 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 3BFB420878; Mon, 12 Oct 2020 13:33:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509600; bh=iRvc1h8Jd7frY6IyZasTKD964KP/bVwB2tsTNK254ho=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=baD1rDVAdJWD4Yw31o3xiQKGevyL40+0DxV9U65xv7OeFo/t4gClVvJzfqT4s+JDD 2tk/mxBde3SGQd5NBZsv9th/quQ1TKjmd9FYDcMwiZppfmTRlvVkK7qWzwTDebwCba 74n+bcolZtY/+vmNaBajZUY3pMvEEsbmot3xjcu8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tom Rix , Hans de Goede , mark gross , Andy Shevchenko Subject: [PATCH 4.4 23/39] platform/x86: thinkpad_acpi: initialize tp_nvram_state variable Date: Mon, 12 Oct 2020 15:26:53 +0200 Message-Id: <20201012132629.240360556@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132628.130632267@linuxfoundation.org> References: <20201012132628.130632267@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Tom Rix commit 5f38b06db8af3ed6c2fc1b427504ca56fae2eacc upstream. clang static analysis flags this represenative problem thinkpad_acpi.c:2523:7: warning: Branch condition evaluates to a garbage value if (!oldn->mute || ^~~~~~~~~~~ In hotkey_kthread() mute is conditionally set by hotkey_read_nvram() but unconditionally checked by hotkey_compare_and_issue_event(). So the tp_nvram_state variable s[2] needs to be initialized. Fixes: 01e88f25985d ("ACPI: thinkpad-acpi: add CMOS NVRAM polling for hot keys (v9)") Signed-off-by: Tom Rix Reviewed-by: Hans de Goede Acked-by: mark gross Signed-off-by: Andy Shevchenko Signed-off-by: Greg Kroah-Hartman --- drivers/platform/x86/thinkpad_acpi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/platform/x86/thinkpad_acpi.c +++ b/drivers/platform/x86/thinkpad_acpi.c @@ -2474,7 +2474,7 @@ static void hotkey_compare_and_issue_eve */ static int hotkey_kthread(void *data) { - struct tp_nvram_state s[2]; + struct tp_nvram_state s[2] = { 0 }; u32 poll_mask, event_mask; unsigned int si, so; unsigned long t; From patchwork Mon Oct 12 13:26:55 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 270196 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 59D9DC43467 for ; Mon, 12 Oct 2020 14:08:32 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 1ABC420E65 for ; Mon, 12 Oct 2020 14:08:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602511712; bh=aIYYaIhEzQZRF+zi3njBCJesd8nzD6h8LV9Bb70iIHU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=ulUGiFq10WdbjY8lpQGYl/WrUC8TXGKsn1oroofuGUHBrTLsGqLN/fTa6gD7NHcyt jzlmShVYXr5IziMoZRNLYCbBkW5o6SbpZmj2hmFynB+GWm5XerlgXiboVkxWL18EbF zEt+uVcbjC1LLnsB8MYGFGTRueoyN+iN+kaHYuWc= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731205AbgJLOIb (ORCPT ); Mon, 12 Oct 2020 10:08:31 -0400 Received: from mail.kernel.org ([198.145.29.99]:35552 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730234AbgJLNdZ (ORCPT ); Mon, 12 Oct 2020 09:33:25 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id B896620678; Mon, 12 Oct 2020 13:33:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509605; bh=aIYYaIhEzQZRF+zi3njBCJesd8nzD6h8LV9Bb70iIHU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YDYjfhWK3pSHyfbLiuhRvRdbTjk6K3H5HKaSOMer/Vt2mNTvVyhK/0k331JlcYBPW 1Ct/rmboffYJIQGZgKzCtE3ONwRqSL4ERoYB55lQ7dTKHj3+DFyPEM5f4TVMiZtjcT NFhEOJfP2JQK4LvJBmHZ9+mYbZ2HP/y0oNIBScrM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot , Geert Uytterhoeven , Tetsuo Handa , stable , "Nobuhiro Iwamatsu (CIP)" Subject: [PATCH 4.4 25/39] driver core: Fix probe_count imbalance in really_probe() Date: Mon, 12 Oct 2020 15:26:55 +0200 Message-Id: <20201012132629.340739665@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132628.130632267@linuxfoundation.org> References: <20201012132628.130632267@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Tetsuo Handa commit b292b50b0efcc7095d8bf15505fba6909bb35dce upstream. syzbot is reporting hung task in wait_for_device_probe() [1]. At least, we always need to decrement probe_count if we incremented probe_count in really_probe(). However, since I can't find "Resources present before probing" message in the console log, both "this message simply flowed off" and "syzbot is not hitting this path" will be possible. Therefore, while we are at it, let's also prepare for concurrent wait_for_device_probe() calls by replacing wake_up() with wake_up_all(). [1] https://syzkaller.appspot.com/bug?id=25c833f1983c9c1d512f4ff860dd0d7f5a2e2c0f Reported-by: syzbot Fixes: 7c35e699c88bd607 ("driver core: Print device when resources present in really_probe()") Cc: Geert Uytterhoeven Signed-off-by: Tetsuo Handa Cc: stable Link: https://lore.kernel.org/r/20200713021254.3444-1-penguin-kernel@I-love.SAKURA.ne.jp [iwamatsu: Drop patch for deferred_probe_timeout_work_func()] Signed-off-by: Nobuhiro Iwamatsu (CIP) Signed-off-by: Greg Kroah-Hartman --- drivers/base/dd.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/drivers/base/dd.c +++ b/drivers/base/dd.c @@ -285,7 +285,8 @@ static int really_probe(struct device *d drv->bus->name, __func__, drv->name, dev_name(dev)); if (!list_empty(&dev->devres_head)) { dev_crit(dev, "Resources present before probing\n"); - return -EBUSY; + ret = -EBUSY; + goto done; } dev->driver = drv; @@ -363,7 +364,7 @@ probe_failed: ret = 0; done: atomic_dec(&probe_count); - wake_up(&probe_waitqueue); + wake_up_all(&probe_waitqueue); return ret; } From patchwork Mon Oct 12 13:26:58 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 270397 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 34082C433DF for ; Mon, 12 Oct 2020 13:33:01 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id D4ACD215A4 for ; Mon, 12 Oct 2020 13:33:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509580; bh=ciPxHtj2f0tQIj3a/F4Xjhz11pILOMIG9uVe5v4llP0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=b4f+y1/jHoLAIZUy6s9IEcE8WJXlfDRcUSNke+GGSci3hoME/togG9tAATT49y6mA XvCJNEJofZO7qntCT5pNCY/vo1u39em9hVJNuaf10URBTSMyc3yE/CUrQ958Z/EPQ6 dnXB21KrNRayxe+nOatH3uEL/AiUytp7H8RRkVJc= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2389047AbgJLNcu (ORCPT ); Mon, 12 Oct 2020 09:32:50 -0400 Received: from mail.kernel.org ([198.145.29.99]:34696 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388998AbgJLNcn (ORCPT ); Mon, 12 Oct 2020 09:32:43 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 497CD2087E; Mon, 12 Oct 2020 13:32:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509560; bh=ciPxHtj2f0tQIj3a/F4Xjhz11pILOMIG9uVe5v4llP0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=bgkIro3utabAAjjjiJmgf27mrF+5l7gx4DHSNGYSOiFQVMOnqZOOob0TgpB1e1Vu6 hu4+/Q+ulz+Nz7cBMPZIc2HBLuNpqceMgMrul7C2XlR1E6FdKfSlsGC12aAsFjR3Mc FDGrZQRtE9zSVxOFo056w2Vk62KIWluEpX4BUOGs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , "David S. Miller" Subject: [PATCH 4.4 28/39] team: set dev->needed_headroom in team_setup_by_port() Date: Mon, 12 Oct 2020 15:26:58 +0200 Message-Id: <20201012132629.478443268@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132628.130632267@linuxfoundation.org> References: <20201012132628.130632267@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Eric Dumazet commit 89d01748b2354e210b5d4ea47bc25a42a1b42c82 upstream. Some devices set needed_headroom. If we ignore it, we might end up crashing in various skb_push() for example in ipgre_header() since some layers assume enough headroom has been reserved. Fixes: 1d76efe1577b ("team: add support for non-ethernet devices") Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- drivers/net/team/team.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/net/team/team.c +++ b/drivers/net/team/team.c @@ -2038,6 +2038,7 @@ static void team_setup_by_port(struct ne dev->header_ops = port_dev->header_ops; dev->type = port_dev->type; dev->hard_header_len = port_dev->hard_header_len; + dev->needed_headroom = port_dev->needed_headroom; dev->addr_len = port_dev->addr_len; dev->mtu = port_dev->mtu; memcpy(dev->broadcast, port_dev->broadcast, port_dev->addr_len); From patchwork Mon Oct 12 13:26:59 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 270396 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A3E71C43457 for ; Mon, 12 Oct 2020 13:33:03 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 589B5215A4 for ; Mon, 12 Oct 2020 13:33:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509583; bh=tTd+Le/81yhAQ2xyfR4Qm36z4Rjv8LTlDbI2rHX8MhM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=XRatYXvdifJdCJ4FrC/CBwUAv7qo0Kpck1vNBEGf4LFBZIk4xCS+DoMdHJGsW2bJb 0PdhlPTLFDAmz06HQls9yGzryOU5qrMJbjI5BtwJv7bRgJpMIvLz5+8pOsPTJxQA1B sGGkzGK5MOMSNw5jUfI/q4YDazWBU5S2KknB+WY8= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2389036AbgJLNct (ORCPT ); Mon, 12 Oct 2020 09:32:49 -0400 Received: from mail.kernel.org ([198.145.29.99]:34698 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2389020AbgJLNco (ORCPT ); Mon, 12 Oct 2020 09:32:44 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 9B64620878; Mon, 12 Oct 2020 13:32:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509563; bh=tTd+Le/81yhAQ2xyfR4Qm36z4Rjv8LTlDbI2rHX8MhM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=v4qaeyHga3FNJxUYujSkYuMVzSK6jEq97dFgacSV3ABWsCnW+Ia9XWqPFGaIuyvJS zufk8+gsgL3BQSaNC1bE4afc5C9Jhr1bQd6vO2kwjuJuidQmwlqgOZblOsb64vGkGc Y1wSiFHy5wltXkIjX5PZfcAUOFMtxNU7xj59mES8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+69b804437cfec30deac3@syzkaller.appspotmail.com, Anant Thazhemadam , "David S. Miller" Subject: [PATCH 4.4 29/39] net: team: fix memory leak in __team_options_register Date: Mon, 12 Oct 2020 15:26:59 +0200 Message-Id: <20201012132629.511847133@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132628.130632267@linuxfoundation.org> References: <20201012132628.130632267@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Anant Thazhemadam commit 9a9e77495958c7382b2438bc19746dd3aaaabb8e upstream. The variable "i" isn't initialized back correctly after the first loop under the label inst_rollback gets executed. The value of "i" is assigned to be option_count - 1, and the ensuing loop (under alloc_rollback) begins by initializing i--. Thus, the value of i when the loop begins execution will now become i = option_count - 2. Thus, when kfree(dst_opts[i]) is called in the second loop in this order, (i.e., inst_rollback followed by alloc_rollback), dst_optsp[option_count - 2] is the first element freed, and dst_opts[option_count - 1] does not get freed, and thus, a memory leak is caused. This memory leak can be fixed, by assigning i = option_count (instead of option_count - 1). Fixes: 80f7c6683fe0 ("team: add support for per-port options") Reported-by: syzbot+69b804437cfec30deac3@syzkaller.appspotmail.com Tested-by: syzbot+69b804437cfec30deac3@syzkaller.appspotmail.com Signed-off-by: Anant Thazhemadam Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- drivers/net/team/team.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/net/team/team.c +++ b/drivers/net/team/team.c @@ -285,7 +285,7 @@ inst_rollback: for (i--; i >= 0; i--) __team_option_inst_del_option(team, dst_opts[i]); - i = option_count - 1; + i = option_count; alloc_rollback: for (i--; i >= 0; i--) kfree(dst_opts[i]); From patchwork Mon Oct 12 13:27:01 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 270388 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 09FA7C433DF for ; Mon, 12 Oct 2020 13:34:28 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id B4512215A4 for ; Mon, 12 Oct 2020 13:34:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509667; bh=4blNXUI1xL+qepDcBCoVHP/4UqJ4NeUDb97ie2v5ehE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=kjkmIkKnrFM00iewU9HqxB864jwUc9Eg92zAdj+bpDUotKYTqdj6QkRonSiHsOC1W 2r73seAkiqwcqcduSs88grDlxY32Mmg2G9eRM67U2aFHvJw5dUYlZRc830J2Sv+77V 9ddyq4PTTtFRmNy90ToTospeahSJ22w+cUF7GCn4= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2389017AbgJLNeO (ORCPT ); Mon, 12 Oct 2020 09:34:14 -0400 Received: from mail.kernel.org ([198.145.29.99]:34782 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2389033AbgJLNcs (ORCPT ); Mon, 12 Oct 2020 09:32:48 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 3909720678; Mon, 12 Oct 2020 13:32:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509567; bh=4blNXUI1xL+qepDcBCoVHP/4UqJ4NeUDb97ie2v5ehE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MVKllAxw/ga2kEr/b+U68lP+YHVddrXzrdiAMTKBXwh0jF7med7le51h9XOoRConl wgoHPivRTy2CjZ4dnKfmFUrHPeUy1e2qnJUTBGv5kPd//NtFN8i1vTh7iAUvwlUpr6 dMHYvzchcd1pGdW5btZxJlz92KFzgkESZ+SxAKps= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Antony Antony , Steffen Klassert , Sasha Levin Subject: [PATCH 4.4 31/39] xfrm: clone XFRMA_REPLAY_ESN_VAL in xfrm_do_migrate Date: Mon, 12 Oct 2020 15:27:01 +0200 Message-Id: <20201012132629.610741704@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132628.130632267@linuxfoundation.org> References: <20201012132628.130632267@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Antony Antony [ Upstream commit 91a46c6d1b4fcbfa4773df9421b8ad3e58088101 ] XFRMA_REPLAY_ESN_VAL was not cloned completely from the old to the new. Migrate this attribute during XFRMA_MSG_MIGRATE v1->v2: - move curleft cloning to a separate patch Fixes: af2f464e326e ("xfrm: Assign esn pointers when cloning a state") Signed-off-by: Antony Antony Signed-off-by: Steffen Klassert Signed-off-by: Sasha Levin --- include/net/xfrm.h | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/include/net/xfrm.h b/include/net/xfrm.h index 89685c7bc7c0f..7a9c18deaa512 100644 --- a/include/net/xfrm.h +++ b/include/net/xfrm.h @@ -1730,21 +1730,17 @@ static inline int xfrm_replay_state_esn_len(struct xfrm_replay_state_esn *replay static inline int xfrm_replay_clone(struct xfrm_state *x, struct xfrm_state *orig) { - x->replay_esn = kzalloc(xfrm_replay_state_esn_len(orig->replay_esn), + + x->replay_esn = kmemdup(orig->replay_esn, + xfrm_replay_state_esn_len(orig->replay_esn), GFP_KERNEL); if (!x->replay_esn) return -ENOMEM; - - x->replay_esn->bmp_len = orig->replay_esn->bmp_len; - x->replay_esn->replay_window = orig->replay_esn->replay_window; - - x->preplay_esn = kmemdup(x->replay_esn, - xfrm_replay_state_esn_len(x->replay_esn), + x->preplay_esn = kmemdup(orig->preplay_esn, + xfrm_replay_state_esn_len(orig->preplay_esn), GFP_KERNEL); - if (!x->preplay_esn) { - kfree(x->replay_esn); + if (!x->preplay_esn) return -ENOMEM; - } return 0; } From patchwork Mon Oct 12 13:27:03 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 270198 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B0E65C433DF for ; Mon, 12 Oct 2020 14:08:16 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 7E44720776 for ; Mon, 12 Oct 2020 14:08:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602511696; bh=Aa1hEP8l8eNGl0K2ERTxmiFBm7d9nfbiKUMwCxfGjHs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=vs8ESFGXLuXA0zUDE/MnZd27Pp+JZSy4ZbiXosq8J9wJmYnEaGdw/90LQSf4eUQ5s 7GyGPom45gu9mGZmEfx0CjXQ7yK9ONFsB3CiDK7q776Gw5IM/iMMGUUbRPuPu6PnRe dUmIr/1cyF38dhecOdR2Eno/18sBKua4poXWLc8s= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730330AbgJLNeO (ORCPT ); Mon, 12 Oct 2020 09:34:14 -0400 Received: from mail.kernel.org ([198.145.29.99]:34872 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2389062AbgJLNcx (ORCPT ); Mon, 12 Oct 2020 09:32:53 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 0EE4A20878; Mon, 12 Oct 2020 13:32:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509572; bh=Aa1hEP8l8eNGl0K2ERTxmiFBm7d9nfbiKUMwCxfGjHs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YjnF/IdhbWz79IaTqLeSEvAZBVuMxDW9hiJKESjDyrJ4edftDe5ROqwwCfCwpGjmJ L2dXAUxzKvZeAgRsQ/P7dQWvHu1vjLpTkG/Qs7oGHgAuvxMhthS/CTxQw2gr/zNL8b OlybDLTkxAS4nL1PAusCMHlW91oyhi2Yo6W8xJkg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Voon Weifeng , Mark Gross , "David S. Miller" , Sasha Levin Subject: [PATCH 4.4 33/39] net: stmmac: removed enabling eee in EEE set callback Date: Mon, 12 Oct 2020 15:27:03 +0200 Message-Id: <20201012132629.693707225@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132628.130632267@linuxfoundation.org> References: <20201012132628.130632267@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Voon Weifeng [ Upstream commit 7241c5a697479c7d0c5a96595822cdab750d41ae ] EEE should be only be enabled during stmmac_mac_link_up() when the link are up and being set up properly. set_eee should only do settings configuration and disabling the eee. Without this fix, turning on EEE using ethtool will return "Operation not supported". This is due to the driver is in a dead loop waiting for eee to be advertised in the for eee to be activated but the driver will only configure the EEE advertisement after the eee is activated. Ethtool should only return "Operation not supported" if there is no EEE capbility in the MAC controller. Fixes: 8a7493e58ad6 ("net: stmmac: Fix a race in EEE enable callback") Signed-off-by: Voon Weifeng Acked-by: Mark Gross Signed-off-by: David S. Miller Signed-off-by: Sasha Levin --- .../net/ethernet/stmicro/stmmac/stmmac_ethtool.c | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-) diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c index fbf701e5f1e9f..6fe441696882d 100644 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c @@ -616,23 +616,16 @@ static int stmmac_ethtool_op_set_eee(struct net_device *dev, struct stmmac_priv *priv = netdev_priv(dev); int ret; - if (!edata->eee_enabled) { + if (!priv->dma_cap.eee) + return -EOPNOTSUPP; + + if (!edata->eee_enabled) stmmac_disable_eee_mode(priv); - } else { - /* We are asking for enabling the EEE but it is safe - * to verify all by invoking the eee_init function. - * In case of failure it will return an error. - */ - edata->eee_enabled = stmmac_eee_init(priv); - if (!edata->eee_enabled) - return -EOPNOTSUPP; - } ret = phy_ethtool_set_eee(dev->phydev, edata); if (ret) return ret; - priv->eee_enabled = edata->eee_enabled; priv->tx_lpi_timer = edata->tx_lpi_timer; return 0; } From patchwork Mon Oct 12 13:27:04 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 270389 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1EBB1C433DF for ; Mon, 12 Oct 2020 13:34:06 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id D5CD82222E for ; Mon, 12 Oct 2020 13:34:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509645; bh=gXAumGFMbP9CeIt6iIs55nIlaRny0KzXuMXPeYDImVc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=uYctPzwMzdEYEmD6VRjRBoKyfkV5Jm6oFpKCpcyd9oLUdB22okVTlbsm+nDXsKICe lXDodqbkAAyBFqLmLHcEo1scFAtAkvlJ2uAiLWTQBk6ok4Tm77pYQ7OyvKuT5ngREG Gmhi+fqEZQobyVmj0k3LgTWU2WaNiekD8aHqPR9A= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2389034AbgJLNeF (ORCPT ); Mon, 12 Oct 2020 09:34:05 -0400 Received: from mail.kernel.org ([198.145.29.99]:34924 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2389007AbgJLNcz (ORCPT ); Mon, 12 Oct 2020 09:32:55 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 617B32087E; Mon, 12 Oct 2020 13:32:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509574; bh=gXAumGFMbP9CeIt6iIs55nIlaRny0KzXuMXPeYDImVc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WiwB378STm2ImoL9+u6Joe3K0w20VQDnYgzyPNBxVA6TYqUBlOmJeYUqIB7efMChs QKQkcfigN1kxesi5NOCBE+sVN919ChSibQopE64GzomFq/e46jXByigv4UQDlWBVfP WbapRQoRjJfIx3HLXG9ZMJ1yB230mmqJiZVcAirI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+577fbac3145a6eb2e7a5@syzkaller.appspotmail.com, Herbert Xu , Steffen Klassert , Sasha Levin Subject: [PATCH 4.4 34/39] xfrm: Use correct address family in xfrm_state_find Date: Mon, 12 Oct 2020 15:27:04 +0200 Message-Id: <20201012132629.735737921@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132628.130632267@linuxfoundation.org> References: <20201012132628.130632267@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Herbert Xu [ Upstream commit e94ee171349db84c7cfdc5fefbebe414054d0924 ] The struct flowi must never be interpreted by itself as its size depends on the address family. Therefore it must always be grouped with its original family value. In this particular instance, the original family value is lost in the function xfrm_state_find. Therefore we get a bogus read when it's coupled with the wrong family which would occur with inter- family xfrm states. This patch fixes it by keeping the original family value. Note that the same bug could potentially occur in LSM through the xfrm_state_pol_flow_match hook. I checked the current code there and it seems to be safe for now as only secid is used which is part of struct flowi_common. But that API should be changed so that so that we don't get new bugs in the future. We could do that by replacing fl with just secid or adding a family field. Reported-by: syzbot+577fbac3145a6eb2e7a5@syzkaller.appspotmail.com Fixes: 48b8d78315bf ("[XFRM]: State selection update to use inner...") Signed-off-by: Herbert Xu Signed-off-by: Steffen Klassert Signed-off-by: Sasha Levin --- net/xfrm/xfrm_state.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c index a3114abe74f20..5bb5950d6276b 100644 --- a/net/xfrm/xfrm_state.c +++ b/net/xfrm/xfrm_state.c @@ -742,7 +742,8 @@ static void xfrm_state_look_at(struct xfrm_policy *pol, struct xfrm_state *x, */ if (x->km.state == XFRM_STATE_VALID) { if ((x->sel.family && - !xfrm_selector_match(&x->sel, fl, x->sel.family)) || + (x->sel.family != family || + !xfrm_selector_match(&x->sel, fl, family))) || !security_xfrm_state_pol_flow_match(x, pol, fl)) return; @@ -755,7 +756,9 @@ static void xfrm_state_look_at(struct xfrm_policy *pol, struct xfrm_state *x, *acq_in_progress = 1; } else if (x->km.state == XFRM_STATE_ERROR || x->km.state == XFRM_STATE_EXPIRED) { - if (xfrm_selector_match(&x->sel, fl, x->sel.family) && + if ((!x->sel.family || + (x->sel.family == family && + xfrm_selector_match(&x->sel, fl, family))) && security_xfrm_state_pol_flow_match(x, pol, fl)) *error = -ESRCH; } @@ -791,7 +794,7 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr, tmpl->mode == x->props.mode && tmpl->id.proto == x->id.proto && (tmpl->id.spi == x->id.spi || !tmpl->id.spi)) - xfrm_state_look_at(pol, x, fl, encap_family, + xfrm_state_look_at(pol, x, fl, family, &best, &acquire_in_progress, &error); } if (best || acquire_in_progress) @@ -807,7 +810,7 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr, tmpl->mode == x->props.mode && tmpl->id.proto == x->id.proto && (tmpl->id.spi == x->id.spi || !tmpl->id.spi)) - xfrm_state_look_at(pol, x, fl, encap_family, + xfrm_state_look_at(pol, x, fl, family, &best, &acquire_in_progress, &error); } From patchwork Mon Oct 12 13:27:09 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 270392 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9FEABC43457 for ; Mon, 12 Oct 2020 13:33:48 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 5715C221FC for ; Mon, 12 Oct 2020 13:33:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509628; bh=DPJ7hSF8Bve5Cv5O4DeRfsryLXidSFc+kkrXAutzhMA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=Qf2Km1ZpHfuOK2dLd1TMIo5sLrjj6TiE0x1fBA5FtpdNn6/dBvYXZw4c5N4sTsogN 3h7ZWqNEtYM1C2euKUInYlzw6rdQ2+O9f2vW3SVy71o5qVQnqX5ocKufoIOIOhW6Vv W2lgUI0kYa5DiZ8mz4VEhRKmPVfczoWdoM2IDjmU= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2389116AbgJLNdq (ORCPT ); Mon, 12 Oct 2020 09:33:46 -0400 Received: from mail.kernel.org ([198.145.29.99]:35232 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2389096AbgJLNdJ (ORCPT ); Mon, 12 Oct 2020 09:33:09 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 8F805204EA; Mon, 12 Oct 2020 13:33:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509589; bh=DPJ7hSF8Bve5Cv5O4DeRfsryLXidSFc+kkrXAutzhMA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TQYnZlBW3aGwDscmi2uUYa4T4XOcVeBHCl9dFGxkqda63+vhc61MECZfAUSCG25P9 tSWngK3Lk9Fp8QENj5b7D46JkfgGbRTXKTy1sz/OSf5u7qS1QoRGUFxJkcsKH7RCHc TF0ei0pe9coQbdvPepTJlDxZvgQJWjnozb8Pm/ZA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+abbc768b560c84d92fd3@syzkaller.appspotmail.com, Petko Manolov , Anant Thazhemadam , "David S. Miller" Subject: [PATCH 4.4 39/39] net: usb: rtl8150: set random MAC address when set_ethernet_addr() fails Date: Mon, 12 Oct 2020 15:27:09 +0200 Message-Id: <20201012132629.954915748@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132628.130632267@linuxfoundation.org> References: <20201012132628.130632267@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Anant Thazhemadam commit f45a4248ea4cc13ed50618ff066849f9587226b2 upstream. When get_registers() fails in set_ethernet_addr(),the uninitialized value of node_id gets copied over as the address. So, check the return value of get_registers(). If get_registers() executed successfully (i.e., it returns sizeof(node_id)), copy over the MAC address using ether_addr_copy() (instead of using memcpy()). Else, if get_registers() failed instead, a randomly generated MAC address is set as the MAC address instead. Reported-by: syzbot+abbc768b560c84d92fd3@syzkaller.appspotmail.com Tested-by: syzbot+abbc768b560c84d92fd3@syzkaller.appspotmail.com Acked-by: Petko Manolov Signed-off-by: Anant Thazhemadam Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- drivers/net/usb/rtl8150.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) --- a/drivers/net/usb/rtl8150.c +++ b/drivers/net/usb/rtl8150.c @@ -277,12 +277,20 @@ static int write_mii_word(rtl8150_t * de return 1; } -static inline void set_ethernet_addr(rtl8150_t * dev) +static void set_ethernet_addr(rtl8150_t *dev) { - u8 node_id[6]; + u8 node_id[ETH_ALEN]; + int ret; - get_registers(dev, IDR, sizeof(node_id), node_id); - memcpy(dev->netdev->dev_addr, node_id, sizeof(node_id)); + ret = get_registers(dev, IDR, sizeof(node_id), node_id); + + if (ret == sizeof(node_id)) { + ether_addr_copy(dev->netdev->dev_addr, node_id); + } else { + eth_hw_addr_random(dev->netdev); + netdev_notice(dev->netdev, "Assigned a random MAC address: %pM\n", + dev->netdev->dev_addr); + } } static int rtl8150_set_mac_address(struct net_device *netdev, void *p)